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mstack Submission for form Security Breach Notifications 


mitted at 04/14/17 4:53 PM 


siness Name: 

Johnson, Hearn, Vinegar & Gee, PLLC 

siness Address: 

434 Fayetteville St. 

#1800 

Raleight, NC 27601 

mpany Type: 

Other 

ur Name: 

Paulette Thomas 

e: 

Counsel 

ntact Address: 

312 Walnut St. 

Suite 3200 

Cincinnati, OH 45202 

ephone Number: 

(513) 929-3483 


ension: 


ail Address: 

pmthomas@bakerlaw.com 

ationship to Org: 

Owner 

ach Type: 

Electronic 

e Breach was Discovered: 

01/16/2017 

iber of Massachusetts 
idents Affected: 

10 

son responsible for data breach.: 

Unknown 

ise give a detailed explanation of 
the data breach occurred.: 

On January 16, 2017, our client became aware of a ransomware attack 
of their computer system. Our client immediately began an 
investigation, reset passwords, removed the server from the system, 
and began using a back-up of their system. As part of their 
investigation, Johnson Hearn engaged a leading forensic firm, and it 
determined that an unknown person remotely accessed a server which 
contained files that may have included individuals’ names, dates of 
birth, driver’s license numbers or state issued identification numbers, 
social security numbers, financial information such as checking/savings 
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Please select the type of personal 
information that was included in the 
breached data.: 


Please check ALL of the boxes that 
apply to your breach.: 

For breaches involving paper: A 
lock or security mechanism was 
used to physically protect the data.: 

Physical access to systems 
containing personal information 
was restricted to authorized 
personnel only.: 

Network configuration of breached 
system: 

Foihreachef Involving electronic 
systems, complete the following: 

Ail Massachusetts residents 
affected by the breach have been 
notified of the breach.: 

Method^) Xised to ihotify p 
Massachusetts residents affected 
by the breach (check all that apply):: 

Date notices were first sent to 
Massachusetts residents 
(MM/DD/YYYY): 

Ail Massachusetts residents 
affected by the breach have been 
offered complimentary credit 
monitoring services .: 

Law enforcement has been notified 
of this data breach.: 

Please describe how your company 
responded to the breach. Include 
what changes were made or may be 
made to prevent another similar 
breach from occurring.: 


account numbers, financial investment information, jp^rtiehicdfd I ^ 
information, and health Insurance numbers. Although no evidence has 
been found that the unknown person accessed or acquired personal 
information, the nature of the incident is such 

Financial Account Numbers = Selection(s) 

Social Security Numbers = Selection(s) 

Driver's License = Selection(s) 

Credit/Debit Card Number = Selection(s) 

The breach was a result of a malicious/criminal act. - Selection(s) 


N/A 


N/A 


Closed System 


Personal information stored on the breached system was password- 
protected and/or restricted by user permissions. = Selection(s) 

Yes 


US Mail = Selections) 

04/14/2017 


Yes 


No 


On January 16, 2017, our client became aware of a ransomware attack 
of their computer system. Our client immediately began arv\ : 

investigation, reset passwords, removed the server from the system, 
and began using a back-up of their system. As part of their | 
investigation, Johnson Hearn engaged a leading forensic finn, and it 
determined that an unknown person remotely accessed a server which 
contained files that may have included individuals’ names, dates of 
birth, driver’s license numbers or state issued identification numbers, 
social security numbers, financial information such as checking/savings 
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" account numbers, financial investment information, payment card 
information, and health insurance numbers. Although no evidence has 
been found that the unknown person accessed or acquired personal 
information, the nature of the incident is such ■ 
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This is a customer service email, 

Formstack, LLC 
8604 Allisonvilie Rd. 
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Indianapolis, IN 46250 
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Monge, Elaine (SCA) 


From: 

Sent: 

To: 

Cc: 

Subject: 

Attachments: 


Kenaley, Patricia <pkenaley@bakerlaw.com> 
Friday, April 14, 2017 4:25 PM 


Breaches, Data (SCA) 
Thomas, Paulette M. 
Incident Notification 


JHVG - MA AG notice Itr. 04.14.17.pdf 


Please see the attached notification. 
Sent on behalf of: 

Paulette Thomas 

Counsel 

BakerHostetler 

312 Walnut Street | Suite 3200 
Cincinnati, OH 45202-4074 
T+1.513.929.3483 

pmthomas@bakerlaw.com 

bakerlaw.com 


o© 


This email is intended only for the use of the party to which it is 
addressed and may contain information that is privileged, 
confidential, or protected by law. If you are not the intended 
recipient you are hereby notified that any dissemination, copying 
or distribution of this email or its contents is strictly prohibited. 

If you have received this message in error, please notify us immediately 
by replying to the message and deleting it from your computer. 

Any tax advice in this email is for information purposes only. The content 
of this email is limited to the matters specifically addressed herein 
and may not contain a full description of all relevant facts or a 
complete analysis of all relevant issues or authorities. 

Internet communications are not assured to be secure or clear of 
inaccuracies as information could be intercepted, corrupted, lost, 
destroyed, arrive late or incomplete, or contain viruses. Therefore, 
we do not accept responsibility for any errors or omissions that are 
present in this email, or any attachment, that have arisen as a result 
of e-mail transmission. 
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BakerHostetler 


April 14,2017 


VIA OVERNIGHT MAIL 

Attorney General Maura Healey 
Office of the Attorney General 
One Ashburton Place 
Boston, MA 02108 

Re: Incident Notification 

Dear Attorney General Healey: 

We are writing on behalf of our client, Johnson, Hearn, Vinegar & Gee, PLLC (“Johnson 
Hearn”), to notify you of a security incident involving Massachusetts residents. 

On January 16, 2017, our client became aware of a ransormvare attack of their computer 
system. Our client immediately began an investigation, reset passwords, removed the server from 
the system, and began using a back-up of their system. As part of their investigation, Johnson 
Hearn engaged a leading forensic firm, and they determined that an unknown person remotely 
accessed a server which contained files that may have included individuals’ names, dates of 
birth, driver’s license numbers or state issued identification numbers, social security numbers, 
financial information such as checking/savings account numbers, financial investment 
information, payment card information, and health insurance numbers. Although no evidence has 
been found that the unknown person accessed or acquired personal information, the nature of the 
incident is such that we cannot rule out that possibility. 

Johnson Hearn is notifying eight (8) Massachusetts residents in substantially the same 
form as the letter attached hereto, with written notification commencing today, April 14, 2017. 1 
Notification is being made as soon as practicable and without unreasonable delay and pursuant to 
the investigation described above, which was necessary to determine the nature and scope of the 
incident; identify the individuals potentially affected; and restore the reasonable integrity of the 
data system. See M.G.L. c. 93H, § 3(b). In addition, Johnson Hearn is offering affected 
individuals a complimentary one-year membership of Experian’s® IdentityWorks SM . This 
product offers affected individuals identity detection and resolution of identity theft. 

Atlanta Chicago Cincinnati Cleveland Columbus Costa Mesa Denver 

Houston Los Angeles New York Orlando Philadelphia Seattle Washington, DC 


Baker&HostetleriLP 

312 Walnut Street 
Suite 3200 

Cincinnati, OH 45202-4074 

T 613.929.3400 
F 613.929.0303 
www.bakeflaw.com 

Paulette M. Thomas 
direct dial: 513.929.3483 
pmthomas@bakerlaw.com 
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To help prevent something like this from happening in the future, Johnson Hearn has 
enhanced the security of their systems. 

Please do not hesitate to contact me if you have any questions regarding this matter. 
Sincerely, 

Paulette M. Thomas 
Counsel 


Enclosures 


cc: (via overnight maiI and emai 1 (data.breaches@state.ma.usV) 

Office of Consumer Affairs and Business Regulation 
Ten Park Plaza, Suite 5170 
Boston, MA 02116 


1 This report is not, and does not constitute, a waiver of personal jurisdiction. 
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Sample Customer 
123 Sample St 
Apt 2 

Dublin, OH 43017 


April 14, 2017 


Notification of Computer System Security Incident 
Dear Sample Customer: 


Johnson, Hearn, Vinegar, & Gee, PLLC is committed to maintaining the privacy and security of the client 
information. We are writing to inform you of an incident that may have affected some of that 
information, including your name, address, date of birth, driver's license number or state issued 
identification number, social security number, financial information, such as checking/savings account 
numbers, or financial investment information, payment card information, and health insurance numbers. 

Out of an abundance of caution, we wanted to notify you of this incident and offer you a complimentary 
one-year membership of Experian’s® IdentityWork$ SM . This product provides you with identity 
detection and resolution of identity theft. The terms and conditions for this offer are located at 
www,ExperianiDWorks.com/restoration . While identity restoration assistance is immediately available 
to you, we also encourage you to activate the fraud detection tools available through Experian 
IdentityWorks. SM For instructions on how to activate your complimentary one-year membership, please 
see the additional information provided in this letter. 

We deeply regret any inconvenience or concern this may cause you. To help prevent something like this 
from happening in the future, we have enhanced the security of our systems. If you have any questions 
please call (855) 474-3854, or for international calls (330) 333-7258, from 9 a.m. to 5 p.m. Eastern Time, 
Monday through Friday. 


Sincerely, 



George G. Hearn 
Managing Member 


Enc. (3 pages) 
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Activate IdentityWorks 8 * 1 in Three Easy Steps 
To start monitoring your personal information please follow the steps below: 

• Ensure that you enroll by: July 31,2017 (Your code will not work after this date.) 

• Visit the Experian Identity Works website to enroll: www.experianidworksxom/creditone 

• Provide your activation code: ABC123 

If you have questions about the product, need assistance with identity restoration that arose as a result of 
this incident or would like an alternative to enrolling in Experian IdentityWorks online, please contact 
Experian’s customer care team at 877-890-9332 by July 31,2017. Be prepared to provide engagement 
number DB01441 as proof of eligibility for the identity restoration services by Experian. 

ADDITIONAL DETAILS REGARDING YOUR 12-MONTH EXPERIAN IDENTITYWORKS 
MEMBERSHIP: 

A credit card is not required for enrollment in Experian IdentityWorks. 

You can contact Experian immediately regarding any fraud issues, and have access to the following 
features once you enroll in Experian IdentityWorks: 

■ Experian credit report at signup: See what information is associated with your credit file. 
Daily credit reports are available for online members only.* 

* Credit Monitoring: Actively monitors Experian, Equifax and Transunion files for indicators of 
fraud, 

■ Internet Surveillance: Technology searches the web, chat rooms & bulletin boards 24/7 to 
identify trading or selling of your personal information on the Dark Web. 

■ Identity Restoration: Identity Restoration specialists are immediately available to help you 
address credit and non-credit related fraud. 

■ Experian IdentityWorks ExtendCARE™: You receive the same high-level of Identity 
Restoration support even after your Experian IdentityWorks membership has expired. 

* $1 Million Identity Theft Insurance**: Provides coverage for certain costs and unauthorized 
electronic fund transfers. 

What you can do to protect your information: There are additional actions you can consider taking to 
reduce the chances of identity theft or fraud on your accounts). Please refer to 
www.ExperianIDWorks.com/restoration for this information. 

Even if you choose not to take advantage of this free credit monitoring service, we recommend that you 
remain vigilant to the possibility of fraud and identity theft by reviewing your credit card, bank, 
and other financial statements for any unauthorized activity. You may also obtain a copy of your 
credit report, free of charge, directly from each of the three nationwide credit reporting agencies. 
To order your credit report, free of charge, once every twelve months, please visit 

www.annualcreditreport.com or call toll-free at 1-877-322-8228. Contact information for the three 
nationwide credit reporting agencies is as follows: 
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Equifax 
PO Box 740241 
Atlanta,GA30374 
www.equifax.com 
1-800-685-1111 


Experian 
PO Box 2002 
Allen, TX 75013 
www.experian.com 
1-888-397-3742 


TransUnion 
PO Box 2000 
Chester, PA 19016 
www,transunion.com 
1-800-916-8800 


If you believe you are the victim of identity theft or have reason to believe your personal information has 
been misused, you should contact the Federal Trade Commission or the Massachusetts Attorney 
GeneraPs Office. Contact information for the Federal Trade Commission and the Massachusetts Attorney 
General's Office is as follows: 

Federal Trade Commission Office of the Attorney General 

600 Pennsylvania Avenue, NW One Ashburton Place 

Washington, DC 20580 Boston, MA 02108 

www.ftc. gov/idtheft www. mass. gov/ago/contact-us, html 

(877) 438-4338 (508) 990-8686 

You can obtain information from these sources about steps an individual can take to avoid identity theft 
as well as information about fraud alerts and security freezes. You should also contact your local law 
enforcement authorities and file a police report, Obtain a copy of the police report in case you are asked 
to provide copies to creditors to correct your records. 

Note that pursuant to Massachusetts law, you have the right to file and obtain a copy of any police report, 

Massachusetts law also allows consumers to request a security freeze. A security freeze prohibits a credit 
reporting agency from releasing any information from your credit report without written 
authorization. Be aware that placing a security freeze on your credit report may delay, interfere with, or 
prevent the timely approval of any requests you make for new loans, credit mortgages, employment, 
housing, or other services. 

The fee for placing a security freeze on a credit report is $5.00. If you are a victim of identity theft and 
submit a valid investigative report or complaint with a law enforcement agency, the fee will be 
waived. In all other instances, a credit reporting agency may charge you up to $5.00 each to place, 
temporarily lift, or permanently remove a security freeze. If you have not been a victim of identity theft, 
you will need to include payment to the credit reporting agency to place, lift, or remove a security freeze 
by check, money order, or credit card. 

To place a security freeze on your credit report, you must send a written request to each of the three major 
reporting agencies by regular, certified, or overnight mail at the addresses below: 

Equifax Security 
Freeze 

POBox 105788 
Atlanta,GA 30348 
www.equifax.com 
1-800-685-1111 


Experian Security 
Freeze 

PO Box 2002 
Allen, TX 75013 
www. experi an .com 
1-888-397-3742 


TransUnion Security Freeze 
PO Box 2000 
Chester, PA 19016 
www.transunion.com 
1-800-916-8800 


In order to request a security freeze, you will need to provide the following information: 

1. Your full name (including middle initial as well as Jr., Sr., II, III, etc.) 

1. Social Security number 

2. Date of birth 
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3. If you have moved in the past five (5) years, provide the addresses where you have lived over the 
prior five years 

4. Proof of current address such as a current utility bill or telephone bill 

5. A legible photocopy of a government issued identification card (state driver's license or ID card, 
military identification, etc.) 

6. If you are a victim of identity theft, include a copy of the police report, investigative report, or 
complaint to a law enforcement agency concerning identity theft 

The credit reporting agencies have three (3) business days after receiving your request to place a security 
freeze on your credit report. The credit bureaus must also send written confirmation to you within five 
(5) business days and provide you with a unique personal identification number (“PIN”) or password or 
both that can be used by you to authorize the removal or lifting of the security freeze. 

To lift the security freeze in order to allow a specific entity or individual access to your credit report, you 
must call or send a written request to the credit reporting agencies by mail and include proper 
identification (name, address, and Social Security number) and the PIN number or password provided to 
you when you placed the security freeze as well as the identity of those entities or individuals you would 
like to receive your credit report or the specific period of time you want the credit report available. The 
credit reporting agencies have three (3) business days after receiving your request to lift the security 
freeze for those identified entities or for the specified period of time. 

To remove the security freeze, you must send a written request to each of the three credit bureaus by mail 
and include proper identification (name, address, and Social Security number) and the PIN number or 
password provided to you when you placed the security freeze. The credit bureaus have three (3) 
business days after receiving your request to remove the security freeze. 


* Offline members will be eligible to call for additional reports quarterly after enrolling. 

** Identity theft insurance is underwritten by insurance company subsidiaries or affiliates of American 
International Group, Inc. (AIG). The description herein is a summary and intended for informational 
purposes only and does not include all terms, conditions and exclusions of the policies described. Please 
refer to the actual policies for terms, conditions, and exclusions of coverage. Coverage may not be 
available in all jurisdictions. 




BakerHostetler 


April 14,2017 


VIA OVERNIGHT MAIL 

Attorney General Maura Healey 
Office of the Attorney General 
One Ashburton Place 
Boston, MA 02108 

Re: Incident Notification 

Dear Attorney General Healey: 

We are writing on behalf of our client, Johnson, Hearn, Vinegar & Gee, PLLC (“Johnson 
Hearn”), to notify you of a security incident involving Massachusetts residents. 

On January 16, 2017, our client became aware of a ransormvare attack of their computer 
system. Our client immediately began an investigation, reset passwords, removed the server from 
the system, and began using a back-up of their system. As part of their investigation, Johnson 
Hearn engaged a leading forensic firm, and they determined that an unknown person remotely 
accessed a server which contained files that may have included individuals’ names, dates of 
birth, driver’s license numbers or state issued identification numbers, social security numbers, 
financial information such as checking/savings account numbers, financial investment 
information, payment card information, and health insurance numbers. Although no evidence has 
been found that the unknown person accessed or acquired personal information, the nature of the 
incident is such that we cannot rule out that possibility. 

Johnson Hearn is notifying eight (8) Massachusetts residents in substantially the same 
form as the letter attached hereto, with written notification commencing today, April 14, 2017. 1 
Notification is being made as soon as practicable and without unreasonable delay and pursuant to 
the investigation described above, which was necessary to determine the nature and scope of the 
incident; identify the individuals potentially affected; and restore the reasonable integrity of the 
data system. See M.G.L. c. 93H, § 3(b). In addition, Johnson Hearn is offering affected 
individuals a complimentary one-year membership of Experian’s® IdentityWorks SM . This 
product offers affected individuals identity detection and resolution of identity theft. 
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Houston Los Angeles New York Orlando Philadelphia Seattle Washington, DC 
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Paulette M. Thomas 
direct dial: 513.929.3483 
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To help prevent something like this from happening in the future, Johnson Hearn has 
enhanced the security of their systems. 

Please do not hesitate to contact me if you have any questions regarding this matter. 
Sincerely, 

T~fyO 1-7^ U- 

Paulette M. Thomas 
Counsel 


Enclosures 


cc: .J (via overnight mail and email (data.breaches@state.ma.usl1 
Office of Consumer Affairs and Business Regulation 
Ten Park Plaza, Suite 5170 
Boston, MA 02116 


1 This report is not, and does not constitute, a waiver of personal jurisdiction. 
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Sample Customer 
123 Sample St 
Apt 2 

Dublin, OH 43017 


April 14, 2017 


Notification of Computer System Security Incident 
Dear Sample Customer: 

Johnson, Hearn, Vinegar, & Gee, PLLC is committed to maintaining the privacy and security of the client 
information. We are writing to inform you of an incident that may have affected some of that 
information, including your name, address, date of birth, driver’s license number or state issued 
identification number, social security number, financial information, such as checking/savings account 
numbers, or financial investment information, payment card information, and health insurance numbers, 

Out of an abundance of caution, we wanted to notify you of this incident and offer you a complimentary 
one-year membership of Experian’s® IdentityWorks SM . This product provides you with identity 
detection and resolution of identity theft. The terms and conditions for this offer are located at 
www.ExperianlDWorks.com/restoration . While identity restoration assistance is immediately available 
to you, we also encourage you to activate the fraud detection tools available through Experian 
IdentityWorks, SM For instructions on how to activate your complimentary one-year membership, please 
see the additional information provided in this letter. 


We deeply regret any inconvenience or concern this may cause you. To help prevent something like this 
from happening in the future, we have enhanced the security of our systems. If you have any questions 
please call (855) 474-3854, or for international calls (330) 333-7258, from 9 a.m. to 5 p.m. Eastern Time, 
Monday through Friday. 


Sincerely, 



George G, Hearn 
Managing Member 


Enc. (3 pages) 
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Activate Identity\Vorks SM iii Three Easy Steps 
To start monitoring your personal information please follow the steps below: 

• Ensure that you enroll by: July 31,2017 (Your code will not work after this date.) 

• Visit the Experian IdentityWorks website to enroll: www.experianidworks.com/creditone 

• Provide your activation code: ABC123 

If you have questions about the product, need assistance with identity restoration that arose as a result of 
this incident or would like an alternative to enrolling in Experian IdentityWorks online, please contact 
Experian 1 s customer care team at 877-890-9332 by July 31,2017, Be prepared to provide engagement 
number DB01441 as proof of eligibility for the identity restoration sendees by Experian. 

ADDITIONAL DETAILS REGARDING YOUR 12-MONTH EXPERIAN IDENTITYWORKS 
MEMBERSHIP: 

A credit card is not required for enrollment in Experian IdentityWorks. 

You can contact Experian immediately regarding any fraud issues, and have access to the following 
features once you enroll in Experian IdentityWorks: 

■ Experian credit report at signup: See what information is associated with your credit file. 
Daily credit reports are available for online members only.* 

■ Credit Monitoring: Actively monitors Experian, Equifax and Transunion files for indicators of 
fraud, 

■ Internet Surveillance: Technology searches the web, chat rooms & bulletin boards 24/7 to 
identify trading or selling of your personal information on the Dark Web. 

■ Identity Restoration: Identity Restoration specialists are immediately available to help you 
address credit and non-credit related fraud. 

* Experian IdentityWorks ExtendCARE™: You receive the same high-level of Identity 
Restoration support even after your Experian IdentityWorks membership has expired. 

■ $1 Million Identity Theft Insurance**: Provides coverage for certain costs and unauthorized 
electronic fund transfers. 

What you can do to protect your information: There are additional actions you can consider taking to 
reduce the chances of identity theft or fraud on your accounts). Please refer to 
www.ExperianIDWorks.com/restoration for this information. 

Even if you choose not to take advantage ofthis free credit monitoring service, we recommend that you 
remain vigilant to the possibility of fraud and identity theft by reviewing your credit card, bank, 
and other financial statements for any unauthorized activity. You may also obtain a copy of your 
credit report, free of charge, directly from each of the three nationwide credit reporting agencies. 
To order your credit report, free of charge, once every twelve months, please visit 

www.annualcreditreport.com or call toll-free at 1-877-322-8228. Contact information for the three 
nationwide credit reporting agencies is as follows: 
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Equifax 

PO Box 740241 
Atlanta,GA30374 
www.equifax.com 
1-800-685-1111 


Experian 
PO Box 2002 
Allen, TX 75013 
www.experian.com 
1-888-397-3742 


TransUnion 
PO Box 2000 
Chester, PA 19016 
www.transunion.com 
1-800-916-8800 


If you believe you 'are the victim of identity theft or have reason to believe your personal information has 
been misused, you should contact the Federal Trade Commission or the Massachusetts Attorney 
General’s Office. Contact information for the Federal Trade Commission and the Massachusetts Attorney 
General’s Office is as follows: 


Federal Trade Commission Office of the Attorney General 

600 Pennsylvania Avenue, NW One Ashburton Place 

Washington, DC 20580 Boston, MA 02108 

w ww. ftc. gov/idtheft www.mass, go v/ago/contact-us .htrnl 

(877) 438-4338 (508) 990-8686 

You can obtain information from these sources about steps an individual can take to avoid identity theft 
as well as information about fraud alerts and security freezes. You should also contact your local law 
enforcement authorities and file a police report. Obtain a copy of the police report in case you are asked 
to provide copies to creditors to correct your records. 

Note that pursuant to Massachusetts law, you have the right to file and obtain a copy of any police report. 

Massachusetts law also allows consumers to request a security freeze. A security freeze prohibits a credit 
reporting agency from releasing any information from your credit report without written 
authorization. Be aware that placing a security freeze on your credit report may delay, interfere with, or 
prevent the timely approval of any requests you make for new loans, credit mortgages, employment, 
housing, or other services. 

The fee for placing a security freeze on a credit report is $5.00. If you are a victim of identity theft and 
submit a valid investigative report or complaint with a law enforcement agency, the fee will be 
waived. In all other instances, a credit reporting agency may charge you up to $5.00 each to place, 
temporarily lift, or permanently remove a security freeze. If you have not been a victim of identity theft, 
you will need to include payment to the credit reporting agency to place, lift, or remove a security freeze 
by check, money order, or credit card. 


To place a security freeze on your credit report, you must send a written request to each of the three major 
reporting agencies by regular, certified, or overnight mail at the addresses below: 


Equifax Security 
Freeze 

POBox 105788 
Atlanta,GA 30348 
www.equifax.com 
1-800-685-1111 


Experian Security 
Freeze 

PO Box 2002 
Allen, TX 75013 
www.experian.com 
1-888-397-3742 


TransUnion Security Freeze 
PO Box 2000 
Chester, PA 19016 
www.transunion.com 
1-800-916-8800 


In order to request a security freeze, you will need to provide the following information: 

L Your full name (including middle initial as well as Jr., Sr., II, III, etc.) 

1. Social Security number 

2, Date of birth 
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3. If you have moved in the past five (5) years, provide the addresses where you have lived over the 
prior five years 

4. Proof of current address such as a current utility bill or telephone bill 

5. A legible photocopy of a government issued identification card (state driver's license or ID card, 
military identification, etc.) 

6. If you are a victim of identity theft, include a copy of the police report, investigative report, or 
complaint to a law enforcement agency concerning identity theft 

The credit reporting agencies have three (3) business days after receiving your request to place a security 
freeze on your credit report. The credit bureaus must also send written confirmation to you within five 
(5) business days and provide you with a unique personal identification number (“PIN”) or password or 
both that can be used by you to authorize the removal or lifting of the security freeze. 

To lift the security freeze in order to allow a specific entity or individual access to your credit report, you 
must call or send a written request to the credit reporting agencies by mail and include proper 
identification (name, address, and Social Security number) and the PIN number or password provided to 
you when you placed the security freeze as well as the identity of those entities or individuals you would 
like to receive your credit report or the specific period of time you want the credit report available. The 
credit reporting agencies have three (3) business days after receiving your request to lift the security 
freeze for those identified entities or for the specified period of time. 

To remove the security freeze, you must send a written request to each of the three credit bureaus by mail 
and include proper identification (name, address, and Social Security number) and the PIN number or 
password provided to you when you placed the security freeze. The credit bureaus have three (3) 
business days after receiving your request to remove the security freeze. 


* Offline members will be eligible to call for additional reports quarterly after enrolling, 

** Identity theft insurance is underwritten by insurance company subsidiaries or affiliates of American 
International Group, Inc. (AIG). The description herein is a summary and intended for informational 
purposes only and does not include all terms, conditions and exclusions of the policies described. Please 
refer to the actual policies for terms, conditions, and exclusions of coverage. Coverage may not be 
available in all jurisdictions. 









